contrast-agent 4.9.0 → 4.12.0

data/lib/contrast/agent/assess/property/tagged.rb

@@ -125,6 +125,27 @@ module Contrast
             tags[label] = tag_ranges
           end
 
+          # Returns a list of all current tags.
+          #
+          # @return [Hash<Contrast::Agent::Assess::Tag>]
+          def get_tags # rubocop:disable Naming/AccessorMethodName
+            return Contrast::Utils::ObjectShare::EMPTY_HASH unless tracked?
+
+            tags
+          end
+
+          # We'll use this as a helper method to retrieve tags from the hash.
+          # Because the hash auto-populates an empty array when we try to
+          # access a tag in it, we cannot use the [] method without side
+          # effect. To get around this, we'll use a fetch work around.
+          #
+          # @param label [Symbol] the label to look up
+          # @return [Array<Contrast::Agent::Assess::Tag>] all the tags with
+          #   that label
+          def fetch_tag label
+            get_tags.fetch(label, nil) if tracked?
+          end
+
           # Remove all tags with a given label
           def delete_tags label
             tags.delete(label) if tracked?
@@ -152,18 +173,6 @@ module Contrast
             tags.delete_if { |_, value| value.empty? }
           end
 
-          # We'll use this as a helper method to retrieve tags from the hash.
-          # Because the hash auto-populates an empty array when we try to
-          # access a tag in it, we cannot use the [] method without side
-          # effect. To get around this, we'll use a fetch work around.
-          #
-          # @param label [Symbol] the label to look up
-          # @return [Array<Contrast::Agent::Assess::Tag>] all the tags with
-          #   that label
-          def fetch_tag label
-            tags.fetch(label, nil) if tracked?
-          end
-
           # Remove all tags within the given ranges.
           # This does not delete an entire tag if part of that tag is
           # outside this range, meaning we may reduce sizes of tags
@@ -218,19 +227,6 @@ module Contrast
             end
           end
 
-          # Because of the auto-fill thing, we should not allow direct access to
-          # the tags hash. Instead, the methods above should be used to do
-          # operations like add, delete, and fetch.
-          #
-          # CONTRAST-22914
-          # please do NOT expose this w/ an attr_reader / accessor. there are
-          # helper methods in this class that safely access the hash. the tags
-          # method is private to avoid the side effect of a direct lookup with
-          # `[]` adding an empty array to the hash.
-          def tags
-            @_tags ||= Hash.new { |h, k| h[k] = [] }
-          end
-
           # Remove the tag ranges covering the given range
           def remove_tags range
             return unless tracked?
@@ -334,6 +330,19 @@ module Contrast
 
           private
 
+          # Because of the auto-fill thing, we should not allow direct access to
+          # the tags hash. Instead, the methods above should be used to do
+          # operations like add, delete, and fetch.
+          #
+          # CONTRAST-22914
+          # please do NOT expose this w/ an attr_reader / accessor. there are
+          # helper methods in this class that safely access the hash. the tags
+          # method is private to avoid the side effect of a direct lookup with
+          # `[]` adding an empty array to the hash.
+          def tags
+            @_tags ||= Hash.new { |h, k| h[k] = [] }
+          end
+
           # Given a tag, compare it to a given range and, if any part of that tag is within the range, return a new tag
           # covering the union of the original tag and the range. This new tag will start at the
           # max(tag.start, range.start) and end at min(tag.end, range.end)

data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb

@@ -20,7 +20,6 @@ module Contrast
           module HardcodedValueRule
             include Contrast::Components::Logger::InstanceMethods
 
-
             def disabled?
               !::Contrast::ASSESS.enabled? || ::Contrast::ASSESS.rule_disabled?(rule_id)
             end

data/lib/contrast/agent/deadzone/policy/policy.rb

@@ -35,6 +35,12 @@ module Contrast
             end
           end
 
+          def validate
+            return if class_name
+
+            raise(ArgumentError, "#{ @node_class } #{ id } did not have a proper class name. Unable to create.")
+          end
+
           def module_names
             @_module_names ||= Set.new(deadzones.map(&:class_name))
           end

data/lib/contrast/agent/disable_reaction.rb

@@ -8,7 +8,7 @@ module Contrast
     # A Reaction from TeamServer which indicates the Agent should be disabled,
     # typically because some configuration setting did not satisfy requirements
     # set by the Organization's Administrator
-    class DisableReaction
+    module DisableReaction
       extend Contrast::Components::Logger::InstanceMethods
 
       def self.run _reaction, level

data/lib/contrast/agent/exclusion_matcher.rb

@@ -94,10 +94,6 @@ module Contrast
         @exclusion.type == Contrast::Api::Settings::Exclusion::ExclusionType::CODE
       end
 
-      def exc_name
-        @exclusion.name # rubocop:disable Security/Module/Name -- part of the API.
-      end
-
       def match_all?
         @exclusion.urls.nil? || @exclusion.urls.empty?
       end

data/lib/contrast/agent/inventory/database_config.rb

@@ -0,0 +1,117 @@
+# Copyright (c) 2021 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/timer'
+require 'contrast/utils/object_share'
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    module Inventory
+      # Methods used for parsing database connection configurations
+      # for getting inventory information from the application
+      module DatabaseConfig
+        extend Contrast::Components::Logger::InstanceMethods
+
+        # TeamServer only accepts certain values for ArchitectureComponents.
+        # DO NOT CHANGE THIS!
+        AC_TYPE_DB = 'db'
+        # TeamServer only accepts certain values for FlowMap Services.
+        # DO NOT CHANGE THIS
+        ADAPTER = 'adapter'
+        HOST = 'host'
+        PORT = 'port'
+        DATABASE = 'database'
+        DEFAULT = 'default'
+        LOCALHOST = 'localhost'
+
+        def self.active_record_config
+          return @_active_record_config if instance_variable_defined?(:@_active_record_config)
+
+          @_active_record_config = ActiveRecord::Base.connection_config rescue nil # rubocop:disable Style/RescueModifier
+        end
+
+        def self.append_db_config(activity_or_update,
+                                  hash_or_str = Contrast::Agent::Inventory::DatabaseConfig.active_record_config)
+          arr = build_from_db_config(hash_or_str)
+          return unless arr&.any?
+
+          arr.each do |a|
+            next unless a
+
+            if activity_or_update.is_a?(Contrast::Api::Dtm::Activity)
+              activity_or_update.architectures << a
+            else
+              activity_or_update.components << a
+            end
+          end
+        rescue StandardError => e
+          logger.error('Unable to append db config', e)
+          nil
+        end
+
+        def self.build_from_db_config hash_or_str
+          return unless hash_or_str
+
+          if hash_or_str.is_a?(Hash)
+            build_from_db_hash(hash_or_str)
+          else
+            build_from_db_string(hash_or_str.to_s)
+          end
+        end
+
+        def self.build_from_db_hash hash
+          ac = Contrast::Api::Dtm::ArchitectureComponent.new
+          ac.vendor = hash[:adapter] || hash[ADAPTER] || Contrast::Utils::ObjectShare::EMPTY_STRING
+          ac.remote_host = host_from_hash(hash)
+          ac.remote_port = port_from_hash(hash)
+          ac.type = AC_TYPE_DB
+          ac.url = hash[:database] || hash[DATABASE] || DEFAULT
+          [ac]
+        end
+
+        def self.host_from_hash hash
+          hash[:host] || hash[HOST] || Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
+        def self.port_from_hash hash
+          p = hash[:port] || hash[PORT] || Contrast::Utils::ObjectShare::EMPTY_STRING
+          p.to_i
+        end
+
+        # Examples:
+        # mongodb://[user:pass@]host1[:port1][,host2[:port2],[,hostN[:portN]]][/[database][?options]]
+        # postgresql://scott:tiger@localhost/mydatabase
+        # mysql+mysqlconnector://scott:tiger@localhost/foo
+        def self.build_from_db_string str
+          adapter, hosts, database = split_connection_str(str)
+          acs = []
+          hosts.split(Contrast::Utils::ObjectShare::COMMA).map do |s|
+            host, port = s.split(Contrast::Utils::ObjectShare::COLON)
+
+            ac = Contrast::Api::Dtm::ArchitectureComponent.new
+            ac.vendor = Contrast::Utils::StringUtils.force_utf8(adapter)
+            ac.remote_host = Contrast::Utils::StringUtils.force_utf8(host)
+            ac.remote_port = port.to_i
+            ac.type = AC_TYPE_DB
+            ac.url = Contrast::Utils::StringUtils.force_utf8(database)
+            acs << ac
+          end
+          acs
+        end
+
+        def self.split_connection_str str
+          adapter, str = str.split(Contrast::Utils::ObjectShare::COLON_SLASH_SLASH)
+          _auth, str = str.split(Contrast::Utils::ObjectShare::AT)
+          # Not currently used
+          # user, pass = auth.split(Contrast::Utils::ObjectShare::COLON)
+          hosts, db_and_options = str.split(Contrast::Utils::ObjectShare::SLASH)
+          hosts << LOCALHOST if hosts.empty?
+          database, _options = db_and_options.split(Contrast::Utils::ObjectShare::QUESTION_MARK)
+
+          [adapter, hosts, database]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/inventory/dependency_usage_analysis.rb

@@ -60,7 +60,7 @@ module Contrast
 
           digest = Contrast::Utils::Sha256Builder.instance.build_from_spec(spec)
           unless digest
-            logger.debug('Unable to resolve digest for gem spec', spec: spec.to_s)
+            logger.debug('Unable to resolve digest for gem spec', spec: spec.to_s) if logger.debug?
             return
           end
           report_path = adjust_path_for_reporting(path, spec)
@@ -76,11 +76,12 @@ module Contrast
           return unless enabled?
           return unless activity
 
-          # Copy gemdigest_cache and clear it in sync.
+          # Disconnect gemdigest_cache and replace it with an empty one; synch so new libs cannot be added between the
+          # assignment and the replace
           gem_spec_digest_to_files = @lock.synchronize do
-            copy = @gemdigest_cache.dup
-            @gemdigest_cache.clear
-            copy
+            hold = @gemdigest_cache
+            @gemdigest_cache = Hash.new { |hash, key| hash[key] = Set.new }
+            hold
           end
 
           gem_spec_digest_to_files.each_pair do |digest, files|

data/lib/contrast/agent/inventory/policy/datastores.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require 'contrast/components/logger'
-require 'contrast/utils/inventory_util'
+require 'contrast/agent/inventory/database_config'
 
 module Contrast
   module Agent
@@ -42,7 +42,7 @@ module Contrast
               context.activity.query_count += 1
               return unless context.activity.query_count == 1
 
-              Contrast::Utils::InventoryUtil.append_db_config(context.activity)
+              Contrast::Agent::Inventory::DatabaseConfig.append_db_config(context.activity)
             end
           end
         end

data/lib/contrast/agent/middleware.rb

@@ -60,6 +60,7 @@ module Contrast
         handle_first_request
         call_with_agent(env)
       end
+      ::Contrast::Components::Logger.add_trace_log_timing_for(::Contrast::Agent::Middleware, :call)
 
       private
 

data/lib/contrast/agent/patching/policy/after_load_patch.rb

@@ -59,7 +59,10 @@ module Contrast
           end
 
           def instrument!
+            return if instrumenting_module == :'Contrast::Framework::Rails::Rewrite' && RAILS_VER >= '2.6.0'
+
             require instrumentation_file_path
+
             if instrumenting_module
               mod = Module.cs__const_get(instrumenting_module)
               with_contrast_scope { mod.instrument } if mod

data/lib/contrast/agent/patching/policy/after_load_patcher.rb

@@ -4,6 +4,7 @@
 require 'contrast/agent/patching/policy/after_load_patch'
 require 'contrast/components/logger'
 require 'contrast/framework/manager'
+require 'contrast/extension/extension'
 
 module Contrast
   module Agent
@@ -29,18 +30,22 @@ module Contrast
           # extensions.
           def apply_direct_patches!
             @_apply_direct_patches ||= begin
-              Contrast::Extension::Assess::ArrayPropagator.instrument_array_track
-              Contrast::Extension::Assess::EvalTrigger.instrument_basic_object_track
-              Contrast::Extension::Assess::EvalTrigger.instrument_module_track
-              Contrast::Extension::Assess::FiberPropagator.instrument_fiber_track
-              Contrast::Extension::Assess::HashPropagator.instrument_hash_track
-              Contrast::Extension::Assess::KernelPropagator.instrument_kernel_track
-              Contrast::Extension::Assess::MarshalPropagator.instrument_marshal_load
-              Contrast::Extension::Assess::RegexpPropagator.instrument_regexp_track
-              Contrast::Extension::Assess::StringPropagator.instrument_string
-              Contrast::Extension::Assess::StringPropagator.instrument_string_interpolation
-
-              Contrast::Extension::Protect::Kernel.instrument
+              paths = %w[
+                array
+                basic_object
+                module
+                fiber_track
+                hash
+                kernel
+                marshal_module
+                regexp
+                string
+                string_interpolation26
+              ].cs__freeze
+              paths.each do |p|
+                path_part = "cs__assess_#{ p }"
+                Contrast::Extension::Assess::InstrumentHelper.instrument "#{ path_part }/#{ path_part }"
+              end
               true
             end
           end

data/lib/contrast/agent/patching/policy/method_policy.rb

@@ -81,15 +81,21 @@ module Contrast
               deadzone_node =    find_method_node(module_policy.deadzone_nodes, method_name, instance_method)
               method_visibility = find_visibility(source_node, propagation_node, trigger_node, protect_node,
                                                   inventory_node, deadzone_node)
-              MethodPolicy.new(method_name: method_name,
-                               method_visibility: method_visibility,
-                               instance_method: instance_method,
-                               source_node: source_node,
-                               propagation_node: propagation_node,
-                               trigger_node: trigger_node,
-                               protect_node: protect_node,
-                               inventory_node: inventory_node,
-                               deadzone_node: deadzone_node)
+              method_policy = MethodPolicy.new(method_name: method_name,
+                                               method_visibility: method_visibility,
+                                               instance_method: instance_method,
+                                               source_node: source_node,
+                                               propagation_node: propagation_node,
+                                               trigger_node: trigger_node,
+                                               protect_node: protect_node,
+                                               inventory_node: inventory_node,
+                                               deadzone_node: deadzone_node)
+
+              return method_policy unless check_method_policy_nodes_empty? source_node, propagation_node, trigger_node,
+                                                                           protect_node, inventory_node, deadzone_node
+
+              create_new_node(module_policy, method_policy) if module_policy.deadzone_nodes&.any?
+              method_policy
             end
 
             def find_method_node nodes, method_name, is_instance_method
@@ -103,6 +109,45 @@ module Contrast
             def find_visibility *nodes
               nodes.find { |node| node }&.method_visibility
             end
+
+            def check_method_policy_nodes_empty?(source_node, propagation_node, trigger_node, protect_node,
+                                                 inventory_node, deadzone_node)
+              return false unless source_node.nil? && propagation_node.nil? && trigger_node.nil? && protect_node.nil? &&
+                  inventory_node.nil? && deadzone_node.nil?
+
+              true
+            end
+
+            private
+
+            def create_new_node module_policy, method_policy
+              return if module_policy.deadzone_nodes.empty?
+
+              module_policy.deadzone_nodes.map do |node|
+                next unless node.method_name.nil?
+
+                klass = Module.cs__const_get(node.class_name)
+                next unless it_defined? klass, method_policy.method_name
+
+                new_node = {}
+                new_node['instance_method'] = method_policy.instance_method
+                new_node['method_visibility'] =
+                  klass.private_method_defined?(method_policy.method_name) ? 'private' : 'public'
+                new_node['method_name'] = method_policy.method_name
+                new_node['class_name'] = node.class_name
+                new_node = Contrast::Agent::Deadzone::Policy::DeadzoneNode.new(new_node)
+                method_policy.instance_variable_set(:@method_visibility, new_node.method_visibility)
+                method_policy.instance_variable_set(:@deadzone_node, new_node)
+                module_policy.deadzone_nodes << new_node
+                break unless method_policy.deadzone_node.nil?
+              end
+            end
+
+            def it_defined? klass, method_name
+              klass.instance_methods(false).include?(method_name) ||
+                  klass.private_instance_methods(false).include?(method_name) ||
+                  klass.singleton_methods(false).include?(method_name)
+            end
           end
         end
       end

data/lib/contrast/agent/patching/policy/module_policy.rb

@@ -12,11 +12,9 @@ module Contrast
         # rather than new.
         class ModulePolicy
           class << self
-            # Given the name of a module, create a :ModulePolicy for it using
-            # the Policy of each supported feature
+            # Given the name of a module, create a :ModulePolicy for it using the Policy of each supported feature.
             #
-            # @param module_name [String] the name of the module to which the
-            #   policy applies
+            # @param module_name [String] the name of the module to which the policy applies.
             # @return [Contrast::Agent::Patching::Policy::ModulePolicy]
             def create_module_policy module_name
               module_policy = Contrast::Agent::Patching::Policy::ModulePolicy.new

data/lib/contrast/agent/patching/policy/patch.rb

@@ -290,6 +290,11 @@ module Contrast
               # we've already patched this class, don't do it again
               return true if methods.include?(cs_method_name)
 
+              # that method is within Contrast definition so it should be skipped
+              method = mod.instance_method(method_policy.method_name) if method_policy.instance_method
+              method = mod.singleton_method(method_policy.method_name) unless method_policy.instance_method
+              return true if method.owner <= Contrast
+
               begin
                 contrast_define_method(mod, method_policy, cs_method_name)
               rescue NameError => e
@@ -332,13 +337,13 @@ module Contrast
             #   :prepend            -> prepend instance method of module
             #   [prepending singleton is easily supported too, just not implemented yet.]
             # @return [Symbol] new alias for the underlying method (presumably, so the patched method can call it)
-            def register_c_patch target_module_name, unbound_method, impl = :alias_instance
+            def register_c_patch target_module_name, unbound_method, impl = :alias_instance # rubocop:disable  Metrics/AbcSize
               # These could be set as AfterLoadPatches.
               method_name = unbound_method.name.to_sym # rubocop:disable Security/Module/Name -- ruby built in attribute.
               underlying_method_name = build_unbound_method_name(method_name).to_sym
 
               target_module = Module.cs__const_get(target_module_name)
-
+              target_module = target_module.cs__singleton_class if %i[prepend_singleton prepend].include? impl
               target_module = target_module.cs__singleton_class if %i[alias_singleton prepend].include? impl
 
               visibility = if target_module.private_instance_methods(false).include?(method_name)
@@ -365,14 +370,20 @@ module Contrast
                   target_module.send(:define_method, method_name, unbound_method.bind(target_module))
                 end
                 target_module.send(visibility, method_name) # e.g., module.private(:my_method)
-              when :prepend
-                prepending_module = Module.new
-                prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
-                prepending_module.send(visibility, method_name)
+              when :prepend_instance, :prepend_singleton
+
+                unless target_module.instance_methods(false).include? underlying_method_name
+
+                  prepending_module = Module.new
+                  prepending_module.send(:define_method, method_name, unbound_method.bind(target_module))
+                  prepending_module.send(visibility, method_name)
+
+                end
                 # This prepends to the singleton class (it patches a class method)
                 target_module.prepend prepending_module
                 # rubocop:enable Performance/Kernel/DefineMethod
               end
+
               # Ougai::Logger.create_item_with_2args calls Hash#[]=, so we
               # can't invoke this logging method or we'll seg fault as we'd
               # change the method definition mid-call

data/lib/contrast/agent/patching/policy/patch_status.rb

@@ -15,13 +15,9 @@ module Contrast
             # @param mod [Module] the Module for which the status is asked
             # @return [Contrast::Agent::Patching::Policy::PatchStatus]
             def get_status mod
-              if mod.cs__const_defined?(status_key, false)
-                mod.cs__const_get(status_key, false)
-              else
-                s = new
-                mod.cs__const_set(status_key, s)
-                s
-              end
+              return mod.cs__const_get(status_key) if mod.cs__const_defined?(status_key, false)
+
+              mod.cs__const_set(status_key, new)
             end
 
             # Allows our C patches to look up the :MethodPolicy for a given

data/lib/contrast/agent/patching/policy/patcher.rb

@@ -54,7 +54,8 @@ module Contrast
             def patch
               catchup_after_load_patches
               catchup_loaded_methods
-              Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolations if RUBY_VERSION < '2.6.0' # TODO: RUBY-714 remove guard w/ EOL of 2.5
+              # TODO: RUBY-714 remove guard w/ EOL of 2.5
+              Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolations if RUBY_VERSION < '2.6.0'
             end
 
             # Hook to only monkeypatch Contrast. This will not trigger any
@@ -86,7 +87,7 @@ module Contrast
 
                 load_patches_for_module(mod_name)
 
-                return unless all_module_names.any?(mod_name)
+                return if all_module_names.none?(mod_name)
 
                 module_data = Contrast::Agent::ModuleData.new(mod, mod_name)
                 patch_into_module(module_data)
@@ -176,12 +177,13 @@ module Contrast
             # @param redo_patch [Boolean] a trigger to force patching regardless of the state of the
             #   Contrast::Agent::Patching::Policy::PatchStatus status on the Module
             def patch_into_module module_data, redo_patch = false
-              status = status_type.get_status(module_data.mod)
+              status = Contrast::Agent::Patching::Policy::PatchStatus.get_status(module_data.mod)
               return if (status&.patched? || status&.patching?) && !redo_patch
 
               # Begin patching our sources into the given module. Any patcher that has the name of the module will be
               # evaluated for patching. Find all the patchers that apply to this class, sorted by type.
               module_policy = Contrast::Agent::Patching::Policy::ModulePolicy.create_module_policy(module_data.mod_name)
+
               # If there's nothing to match, then set that status and exit
               if module_policy.empty?
                 status.no_patch!
@@ -191,8 +193,8 @@ module Contrast
               status.patching!
               num_applied_patches = patch_into_instance_methods(module_data, module_policy)
               num_applied_patches += patch_into_singleton_methods(module_data, module_policy)
-              if adjust_for_prepend(module_data) || module_policy.num_expected_patches == num_applied_patches
 
+              if adjust_for_prepend(module_data) || module_policy.num_expected_patches == num_applied_patches
                 status.patched!
               else
                 status.partial_patch!
@@ -244,6 +246,7 @@ module Contrast
             def patch_into_instance_methods module_data, module_policy
               mod = module_data.mod
               methods = all_instance_methods(mod, true)
+              methods.delete(:initialize) if mod.to_s.starts_with?('RSpec') && mod.to_s.include?('Matchers')
               patch_into_methods(mod, methods, module_policy, true)
             end
 
@@ -258,8 +261,7 @@ module Contrast
               patch_into_methods(mod, methods, module_policy, false)
             end
 
-            # We've found the patchers that apply to this class (or module). Now we'll
-            # filter on the given method.
+            # We've found the patchers that apply to this class (or module). Now we'll filter on the given method.
             #
             # @param mod [Module] The module from which to retrieve instance methods.
             # @param methods [Array<Symbol>] The names of all the methods in in this module
@@ -276,8 +278,7 @@ module Contrast
                                                                                                     is_instance_method)
                 next if method_policy.empty?
 
-                patched = patch_method(mod, methods, method_policy)
-                count += 1 if patched
+                count += 1 if patch_method(mod, methods, method_policy)
               end
               count
             end
@@ -309,6 +310,5 @@ require 'contrast/extension/module'
 require 'contrast/extension/assess'
 require 'contrast/extension/inventory'
 require 'contrast/extension/protect'
-require 'contrast/extension/protect/kernel'
 
 require 'cs__contrast_patch/cs__contrast_patch'

data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb

@@ -14,7 +14,7 @@ module Contrast
         # infilter methods of the rule should be invoked.
         module AppliesNoSqliRule
           extend Contrast::Agent::Protect::Policy::RuleApplicator
-
+          DATABASE_NOSQL = 'MongoDB'
           class << self
             def invoke method, _exception, properties, _object, args
               return unless valid_input?(args)